The Polish Personal Data Protection Office (PUODO) has imposed a financial penalty of 64,652 zł on Wyższa Szkoła Logistyki w Poznaniu for violations of the General Data Protection Regulation (RODO).
The case originated from an incident in which a university employee mistakenly attached a file containing personal data of 964 students to a message about specialty and language group assignments on the online deanery platform. The file was subsequently opened by 125 of the 388 individuals granted access and downloaded 361 times.
During its investigation, PUODO determined that the university had not performed an adequate risk analysis. The existing assessment considered threats such as hardware failure, system damage, malware infection, and unauthorized access or data transfer to external media, but it omitted the risk of accidental data disclosure. A follow-up analysis conducted after the breach retained the same limited scope and was not updated.
These shortcomings were classified as breaches of the principles of integrity and confidentiality as well as accountability. Although the university claimed it conducted selective checks on information transmission methods, no supporting evidence was provided.
President Mirosław Wróblewski decided to impose the fine and ordered the university to implement appropriate technical and organizational measures to reduce risks associated with personal data processing. The decision references a similar earlier case involving ING Bank Śląski, which received an 18,416,400 zł penalty that was later upheld by the Voivodeship Administrative Court in Warsaw.
